<h2>Key Takeaways</h2>
<ul>
<li>Three UK businesses, <a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK</a>, all deployed Managed Detection and Response as their central cyber security investment, but each arrived at it from a completely different starting position: one after real financial damage, one as a foundation built in before any incident occurred, and one as the latest chapter in a decade-long relationship with no specific breach mentioned at all.</li>
<li>A1 Pharmaceuticals&#8217; investment was reactive in the most direct sense possible. The company suffered a ransomware attack that cost three days of business, then a coordinated Christmas-season breach that cost more than £50,000 and forced it to disconnect its external connectivity entirely. &#8220;Cyber security has to be taken seriously,&#8221; said Chris Dancer, the company&#8217;s Managing Director. &#8220;Thanks to the support of Arc and the insights from our past experiences, the changes we&#8217;ve made have genuinely paid off.&#8221;</li>
<li>Oxford Cancer Analytics, working with the same vendor, Arc, took the opposite path: building Sophos MDR, XGS firewalls and GPU-capable infrastructure in from the outset as a young healthcare technology company handling sensitive medical and scientific data, rather than responding to an incident after the fact. &#8220;Handling sensitive medical and scientific data requires absolute trust and, from day one, the Arc team provided the infrastructure and expertise we could rely on,&#8221; said Luke Hankey, the company&#8217;s Head of IT and Software.</li>
<li>Neville UK&#8217;s story is different again: a decade-long relationship with a different provider, Air IT Group, protecting around 300 users across a 24/7 global operation, with Managed Detection and Response and Managed SIEM layered onto an existing partnership rather than triggered by any single event this publication&#8217;s own case study names. &#8220;Air IT Group have shown to be the best partner we could have for many years,&#8221; said Brian Westfall, the company&#8217;s IT Manager.</li>
<li>Read together, the three cases show Managed Detection and Response isn&#8217;t one kind of purchase with one kind of trigger. It&#8217;s the same category of product solving three different organisational problems: recovering trust after real damage, building credibility before it&#8217;s tested, and sustaining a long, ongoing relationship. For a UK C-suite, the useful question when evaluating a similar investment isn&#8217;t which MDR provider to choose, it&#8217;s which of these three starting positions actually describes the organisation making the decision.</li>
</ul>
<p>Managed Detection and Response shows up as the headline technology in a lot of UK cyber security case studies, and it&#8217;s easy to read that repetition as evidence the product itself is the interesting part. Three case studies published on this site, at <a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK</a>, suggest the more useful story is what each company was actually starting from when it bought the same category of product.</p>
<h2>A1 Pharmaceuticals: MDR bought after the damage was already done</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>&#8216; path to Managed Detection and Response ran directly through two costly incidents. A ransomware attack cost the company three days of business, and a later, coordinated Christmas-season breach cost more than £50,000 and forced the company to disconnect its external connectivity entirely to contain it. That second incident deepened an existing cyber security partnership with Arc rather than starting a new one. &#8220;Cyber security has to be taken seriously,&#8221; said Chris Dancer, A1 Pharmaceuticals&#8217; Managing Director. &#8220;Thanks to the support of Arc and the insights from our past experiences, the changes we&#8217;ve made have genuinely paid off; we&#8217;ve stopped further attacks, protected our data and strengthened the business.&#8221; The resulting deployment combined Managed Detection and Response, multi-factor authentication across every system, upgraded Sophos firewall and antivirus protection, regular penetration testing, and bi-weekly staff cyber awareness emails backed by real-time monitoring. &#8220;I now make time for every cyber security conversation, because I know just how much it matters,&#8221; Dancer said, a direct statement about how the incidents changed his own attention to the subject, not just the company&#8217;s technical posture. The new defences have since caught a financial fraud attempt involving compromised credentials before any money moved, and flagged several other threats early enough to prevent disruption.</p>
<h2>Oxford Cancer Analytics: the same category of product, built in before there was anything to react to</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a>, working with the same vendor, Arc, tells a structurally different story with the same underlying technology. As a young healthcare technology company handling sensitive medical and scientific data, OXcan needed secure, high-performance infrastructure that could support rapid expansion while maintaining a strong security posture from the start, not after an incident forced the issue. &#8220;Handling sensitive medical and scientific data requires absolute trust and, from day one, the Arc team provided the infrastructure and expertise we could rely on,&#8221; said Luke Hankey, OXcan&#8217;s Head of IT and Software. The build covered a managed environment for 19 users with endpoint protection and Sophos MDR, Sophos XGS firewalls across six network devices, and high-performance, GPU-capable servers to support machine learning workloads, alongside a migration to Mimecast for email with DMARC improvements. &#8220;Their proactive approach and well-designed solutions have played a key role in strengthening our overall security posture,&#8221; Hankey said. Nothing in OXcan&#8217;s own case study describes a breach, an attack, or a specific triggering event; the investment is framed entirely as groundwork laid ahead of scale, the inverse of A1 Pharmaceuticals&#8217; sequence with the same vendor.</p>
<h2>Neville UK: the same product, arrived at through a decade of relationship rather than a single decision</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK PLC</a>, a family business running a 24/7 global operation with roughly 300 IT users, reached the same category of technology, Managed Detection and Response paired with a Managed SIEM, through a different route again: a decade-long IT partnership with Air IT Group, a different vendor from Arc, rather than a single event or a from-day-one build. The case study names no specific incident driving the decision, instead describing an ongoing need for continuous protection, proactive IT support and a stable foundation for the company&#8217;s wider technology investment, including a migration to Microsoft Azure delivered as part of the same engagement. &#8220;Air IT Group have shown to be the best partner we could have for many years,&#8221; said Brian Westfall, Neville UK&#8217;s IT Manager. &#8220;They provide 24/7 Managed IT Support as well a variety of Cyber Security Services and their deep understanding of our infrastructure and commitment to 24/7 monitoring gives us real peace of mind that we are protected.&#8221; &#8220;With Air we feel well and truly protected and supported,&#8221; Westfall added. &#8220;Anytime we need them, they&#8217;re there for us!&#8221; Where A1 Pharmaceuticals&#8217; quotes describe relief after damage and OXcan&#8217;s describe confidence built in advance, Neville UK&#8217;s describe something closer to accumulated trust over time, the product of a long relationship rather than a discrete before-and-after moment.</p>
<h2>What a UK C-suite should actually take from reading these three together</h2>
<p>Two of these three companies used the same vendor, Arc, and arrived at nearly identical technology, Managed Detection and Response layered with Sophos tooling, from opposite starting points: one recovering from real financial and operational damage, the other building the same defences in before anything had gone wrong. The third reached a comparable outcome, MDR and Managed SIEM, through neither a crisis nor a from-day-one build, but a decade of accumulated partnership with a different provider entirely. None of the three case studies describes MDR itself as the differentiator; each one&#8217;s own account centres on when and why the decision got made, not which specific product was chosen. For a UK C-suite weighing a similar investment, the practical lesson these three cases suggest is to be honest about which of these three positions actually describes the organisation, already damaged and rebuilding trust, early-stage and building credibility ahead of scale, or established and extending a long relationship, because that starting position, more than the product category itself, is what each of these three companies&#8217; own case studies actually describe as the reason the investment mattered.</p>


A1 Pharmaceuticals, Oxford Cancer Analytics and Neville UK: What ‘Managed Detection and Response’ Actually Means in Three Sectors

<h2>Key Takeaways</h2>
<ul>
<li>Four NHS trusts&#8217; published cyber security case studies look, from a distance, like four separate stories. Read closely, three of them, <a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-community-healthcare-trust-cyberguard-siem-soc">Birmingham Community Healthcare</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/wrightington-wigan-leigh-nhs-soc-cybersecurity">Wrightington, Wigan and Leigh</a>, and <a rel="nofollow" href="https://www.networksjournal.com/content/royal-orthopaedic-hospital-cyber-security-support">Royal Orthopaedic Hospital</a>, converge on the same vendor, the same underlying model, and, in two cases, the exact same documented reason for choosing it.</li>
<li>Birmingham Community Healthcare&#8217;s own account is explicit about the trigger: &#8220;Ever since WannaCry back in 2017, the Trust&#8217;s Board of Directors and I recognised we needed to up our game in regard to cyber security and give it the resource it demands,&#8221; said Gerard Kilgallon, the Trust&#8217;s Head of IT. Wavenet ran a proof of concept, then expanded into a full Security Information and Event Management deployment and CREST-approved penetration testing.</li>
<li>Wrightington, Wigan and Leigh didn&#8217;t arrive at the same vendor independently. This publication&#8217;s own case study states the Trust &#8220;looked to Wavenet after seeing the benefits CyberGuard had delivered for Birmingham Community Healthcare NHS Foundation Trust,&#8221; a directly documented reference chain between two NHS trusts, not an assumption. WWL added a UK-based, 24/7/365 Security Operations Centre and cited the same national pressure Birmingham Community Healthcare named: &#8220;Cyber attacks are increasing yearly, and because of that, so is the demand for security coverage,&#8221; said Alan Moss, the Trust&#8217;s IT Programme Manager.</li>
<li>Royal Orthopaedic Hospital&#8217;s case study describes a third, related layer of the same referral pattern: Wavenet&#8217;s existing relationship with Birmingham Women&#8217;s and Children&#8217;s NHS Foundation Trust, a fellow member of the same Integrated Care System, gave the hospital &#8220;further confidence in the relationship&#8221; before it signed on for 24/7/365 cloud-based cyber support.</li>
<li>Oxford University Hospitals&#8217; project, unlike the other three, has nothing to do with detecting or responding to attacks. Working with Telefónica Tech and Starlight Consulting rather than Wavenet, it built a Secure Data Environment governing how more than 30 billion health records can be safely accessed by researchers, a data governance and access-control problem, not a threat-detection one. For a UK C-suite, the useful distinction these four case studies draw isn&#8217;t &#8220;which vendor NHS trusts prefer.&#8221; It&#8217;s that &#8220;NHS cyber security&#8221; case studies actually describe two entirely different disciplines, defending infrastructure against attackers, and governing safe access to data, and only one of those two disciplines shows the peer-reference pattern visible across three of these four trusts.</li>
</ul>
<p>Four NHS organisations&#8217; published cyber security case studies sit in the same category on paper. Read together, they reveal something more specific than &#8220;the NHS is investing in cyber security&#8221;: three of the four trusts didn&#8217;t make their decision independently at all, they can be traced, in their own words, back to a single earlier deployment and a shared trigger, the 2017 WannaCry ransomware attack. The fourth solved a problem the other three never mention.</p>
<h2>Birmingham Community Healthcare: the trust that started the chain</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-community-healthcare-trust-cyberguard-siem-soc">Birmingham Community Healthcare NHS Foundation Trust</a>, which delivers more than 100 clinical services across 200 hospitals, health centres and clinics, traces its cyber security investment directly to a single event. &#8220;Ever since WannaCry back in 2017, the Trust&#8217;s Board of Directors and I recognised we needed to up our game in regard to cyber security and give it the resource it demands,&#8221; said Gerard Kilgallon, the Trust&#8217;s Head of IT. The Trust&#8217;s disparate workforce and IT landscape, combined with limited internal cyber security expertise, had made a coherent strategy difficult to build while the IT team&#8217;s priority remained keeping clinical services running. Wavenet ran a proof of concept for its CyberGuard solution over several weeks, alongside setting up a Critical Incident Response Service so a Security Operations Centre could investigate and remediate threats at source. &#8220;The proof of concept went as well as it possibly could have, the process of integrating new systems and protocols was managed seamlessly,&#8221; Kilgallon said. Wavenet&#8217;s role has since expanded to a full Security Information and Event Management deployment and CREST-approved internal and external penetration testing, giving the Trust what its own case study describes as constant threat detection through the Security Operations Centre.</p>
<h2>Wrightington, Wigan and Leigh: a documented reference, not a coincidence</h2>
<p>What makes <a rel="nofollow" href="https://www.networksjournal.com/content/wrightington-wigan-leigh-nhs-soc-cybersecurity">Wrightington, Wigan and Leigh Teaching Hospitals NHS Foundation Trust&#8217;s</a> case study worth reading directly against Birmingham Community Healthcare&#8217;s is that the connection between them isn&#8217;t inferred, it&#8217;s stated. WWL, a medium-sized Trust supporting 7,000 active IT users across the Wigan borough and Greater Manchester, &#8220;looked to Wavenet after seeing the benefits CyberGuard had delivered for Birmingham Community Healthcare NHS Foundation Trust,&#8221; according to this publication&#8217;s own account. Facing the same post-WannaCry threat landscape and a national NHS cyber security skills shortage, WWL combined a Managed Detect and Respond solution with Microsoft Azure Sentinel as its SIEM system, monitored 24/7/365 from a UK Security Operations Centre, and ran a three-month trial with weekly review meetings before committing to a full partnership. &#8220;Cyber security is an ever-evolving challenge and partnering with Wavenet put us in the best position to protect ourselves,&#8221; said Malcolm Gandy, WWL&#8217;s Chief Information Officer. Alan Moss, the Trust&#8217;s IT Programme Manager, named the same pressure Birmingham Community Healthcare&#8217;s own case study describes: &#8220;Cyber attacks are increasing yearly, and because of that, so is the demand for security coverage.&#8221;</p>
<h2>Royal Orthopaedic Hospital: the third link in the same chain</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/royal-orthopaedic-hospital-cyber-security-support">The Royal Orthopaedic Hospital NHS Foundation Trust</a>, one of the largest specialist orthopaedic units in Europe, extends the same pattern a step further. As part of the NHS Integrated Care System covering Birmingham and Solihull, whose shared processes aren&#8217;t always suited to fast implementation, ROH needed to replace an on-premise security setup and traditional service desk cover that didn&#8217;t extend to out-of-hours cyber alerts. It, too, chose Wavenet, moving to a cloud-based cyber security service with 24/7/365 support, standardised alert handling and a formal internal IT service management system built around weekly checkpoints. The Trust&#8217;s own case study is specific about why the choice felt lower-risk than it might otherwise have: Wavenet&#8217;s existing work with Birmingham Women&#8217;s and Children&#8217;s NHS Foundation Trust, a fellow member of the same Integrated Care System, gave ROH &#8220;further confidence in the relationship.&#8221; &#8220;Wavenet consistently outperformed, outpriced, and out serviced other providers,&#8221; said Chris Page, ROH&#8217;s Cyber Security Consultant. &#8220;We were looking for the best service and value for money, that offered the best protection to the widest number of threats that we both knew and didn&#8217;t know about.&#8221;</p>
<h2>Oxford University Hospitals: a fourth NHS trust, and a completely different problem</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/oxford-university-hospitals-secure-data-environment-telefonica-tech">Oxford University Hospitals NHS Foundation Trust&#8217;s</a> case study sits in the same &#8220;NHS cyber security&#8221; category as the other three on this publication&#8217;s own tagging, and describes something with almost no overlap in substance. Working with Telefónica Tech and Starlight Consulting rather than Wavenet, OUH built the Thames Valley and Surrey Secure Data Environment, unifying more than 30 billion health records covering a population of 4.3 million people into a single, secure research platform. The problem it solved wasn&#8217;t detecting or responding to attackers; it was governance, giving researchers safe, ethical, de-identified access to data that traditional processes had made slow and fragmented to obtain, sometimes taking years to establish, across dozens of NHS organisations each running bespoke research approval processes. The team stood up the initial environment and began onboarding data sources within six weeks, building in joint controllership agreements with NHS partners, an airlock process controlling what data can leave the environment, and a patient and public access review committee. More than 35 research projects are now live, with over 100 approved researchers accessing the platform. &#8220;Every day, vast amounts of health data are collected, but much of its potential remains untapped, not just because of time constraints, but because traditional systems made it difficult for anyone to access and use this information effectively,&#8221; said Professor Jim Davies, the environment&#8217;s Chief Technical Officer. Nothing in Oxford University Hospitals&#8217; case study references WannaCry, a Security Operations Centre, or any of the threat-detection language that runs through the other three trusts&#8217; accounts, because it was never solving that problem.</p>
<h2>What a UK C-suite should actually take from reading these four together</h2>
<p>The instructive finding here isn&#8217;t that NHS trusts are investing in cyber security, every large UK institution is. It&#8217;s that three of these four trusts&#8217; decisions can be traced through a documented chain rather than treated as four independent choices: Birmingham Community Healthcare built the original CyberGuard deployment in response to WannaCry, Wrightington, Wigan and Leigh explicitly chose the same vendor after seeing what it delivered there, and Royal Orthopaedic Hospital drew confidence from Wavenet&#8217;s separate work with a fellow Integrated Care System member. That&#8217;s a real, citable pattern of peer reference inside a single sector, not a coincidence of three trusts reaching for the same category of tool. Oxford University Hospitals&#8217; case study is the useful control: tagged the same way, published in the same category, but solving a governance and access problem with an entirely different vendor and no trace of the same reference chain. For a UK C-suite evaluating its own cyber security investment, the practical lesson from all four together is that a vendor&#8217;s track record inside your own sector, not just its general reputation, is doing real, documented work in how similar organisations actually choose, and that &#8220;cyber security&#8221; as a category still needs breaking apart into what specific problem, attack detection or data governance, is actually being solved before any of these four trusts&#8217; results can be read as a template.</p>


Three NHS Trusts Chose the Same Cyber Security Vendor for the Same Reason. A Fourth Solved a Completely Different Problem

<h2>Key Takeaways</h2>
<ul>
<li>Apollo Global Management, which manages $938 billion in assets, confirmed that hackers accessed its cloud systems between July 6 and July 10, 2026, exposing names, dates of birth, home addresses, contact information and Social Security numbers.</li>
<li>Google&#8217;s threat intelligence team tracks the group behind this campaign as UNC6671, operating under the aliases Falcon, Helix, Pink and Redact; subsequent reporting on that research has tied the campaign to Apollo, Blackstone, Bridgewater and Bain Capital, among other firms.</li>
<li>The attackers do not rely on malware or software exploits. They call employees on their personal mobile phones, impersonate the internal IT helpdesk, and talk victims into entering credentials and multi-factor authentication codes on lookalike login pages.</li>
<li>Apollo is offering affected individuals 24 months of complimentary credit monitoring and identity protection through Cyberscout, including proactive fraud assistance, with enrollment required within 90 days.</li>
<li>Google&#8217;s researchers recommend phishing-resistant, FIDO2-based authentication, shorter session lifetimes, and stricter controls on IT helpdesk identity verification as the most effective defenses against this style of attack.</li>
</ul>
<div style="border: 1px solid #ddd; border-radius: 8px; padding: 20px 24px; margin: 24px 0; background: #f9f9f9;">
<h3 style="margin-top: 0;">Social Engineering Attacks: 2023–2026 at a Glance</h3>
<p style="margin-bottom: 8px;"><strong>Most reported social engineering techniques against enterprises (industry threat reporting, 2023–2026):</strong></p>
<ul style="margin-bottom: 8px;">
<li>Phishing and spear-phishing email remains the most common initial-access technique reported across the period, typically used to harvest credentials or deliver malicious links and attachments.</li>
<li>Voice phishing (vishing), including help desk and IT support impersonation, has grown sharply as a distinct category since 2023, driven by campaigns targeting large enterprises through calls to employees&#8217; personal phones.</li>
<li>Adversary-in-the-middle (AiTM) phishing kits, which proxy a real login session to steal credentials and session cookies in real time, have become a standard tool for bypassing traditional multi-factor authentication.</li>
<li>SIM swapping and MFA-fatigue (push-bombing) attacks continue to be used to defeat one-time-passcode and push-based authentication.</li>
<li>Business email compromise, where attackers impersonate executives or vendors to redirect payments, remains one of the costliest categories by reported financial loss, according to the FBI&#8217;s Internet Crime Complaint Center.</li>
</ul>
<p style="margin-bottom: 0; font-size: 0.9em; color: #555;">Figures reflect patterns described in public threat intelligence reporting, including from Google/Mandiant, the FBI IC3, and industry incident-response reports, rather than a single unified dataset.</p>
</div>
<p>Private equity firms manage some of the most sensitive information in the financial system: the personal data of limited partners, the financial details of portfolio companies, and deal information worth billions of dollars before it becomes public. That combination has made them a priority target for a hacking campaign that does not need to break through a firewall or exploit a piece of software. It only needs to get one employee on the phone.</p>
<h2>What happened at Apollo</h2>
<p>Apollo Global Management, the private equity firm that manages $938 billion in assets and employs roughly 5,000 people, confirmed that hackers gained unauthorized access to certain of its cloud platforms between July 6 and July 10, 2026. The firm disclosed the incident in a <a href="https://oag.ca.gov/ecrime/databreach/reports/sb24-628551" target="_blank" rel="nofollow noopener">breach notification letter filed with the California Attorney General</a> on August 20, 2026, which confirmed at least 500 California residents were affected; the total number of people impacted nationwide has not been made public.</p>
<p>The categories of data involved were names, dates of birth, contact information, home addresses, and Social Security numbers, according to the filing. Apollo has said it has no evidence, at this time, that the information has been publicly posted or used for identity theft or fraud.</p>
<p>Apollo was not alone. Press coverage of the same UNC6671 campaign, drawing on the Google research described below, has reported that Blackstone, Bridgewater and Bain Capital were also targeted, among a wider group of firms across other sectors caught up in the same threat actor&#8217;s activity.</p>
<h2>What they&#8217;re doing about it</h2>
<p>Apollo&#8217;s response follows the standard playbook for a breach involving Social Security numbers and other identifying data. The firm is providing affected individuals with what its notification describes as &#8220;complimentary access to Credit Monitoring and Identity Protection Services at no charge.&#8221; Enrolled individuals receive alerts &#8220;for twenty-four months from the date of enrollment when changes occur to your credit file,&#8221; giving them an early warning if someone tries to open a line of credit or otherwise use their identity fraudulently.</p>
<p>Alongside credit monitoring, Apollo is providing access to Cyberscout, a service that offers what the notification describes as &#8220;proactive fraud assistance.&#8221; Cyberscout&#8217;s model typically pairs the monitoring alerts with a case manager who helps a victim work through the practical steps of freezing credit, disputing fraudulent accounts and replacing compromised identity documents if fraud does occur, rather than leaving individuals to navigate that process alone. Enrollment is time-limited, with individuals given 90 days from the date of the letter to sign up. Apollo reported $938 billion in assets under management at the time of disclosure; the firm&#8217;s total has continued to grow since, underscoring just how much sensitive client and deal data now sits behind the credentials these attackers are after.</p>
<p>Credit monitoring and identity protection are a reasonable, and now fairly standard, response once a breach involving Social Security numbers has already happened. But they are a remedy for affected individuals after the fact. They do nothing to close the gap that let the attackers in, and boards at other financial services firms are increasingly asking a harder question: what would have stopped this before it started.</p>
<h2>How firms are hardening themselves before an incident</h2>
<p>Financial services firms outside the private equity and asset management space have already had to answer that question, and the steps they&#8217;ve taken are instructive. In a recent case study on this site, building products supplier Lambson used a <a href="https://www.networksjournal.com/content/lambson-building-products-penetration-test-cloud-overhaul" target="_blank" rel="nofollow noopener">penetration test to identify weaknesses in its cloud environment</a> and worked through a structured cloud security overhaul before those weaknesses could be exploited. Separately, packaging manufacturer Allpack put in place <a href="https://www.networksjournal.com/content/allpack-protects-growing-workforce-with-automated-dark-web-monitoring" target="_blank" rel="nofollow noopener">automated dark web monitoring</a> to catch employee and customer credentials that had already leaked, before they could be used against the company in exactly the kind of credential-based attack now being used against private equity firms.</p>
<p>Both cases point to the same underlying principle: the most damaging attacks against enterprises today rarely start with a sophisticated exploit. They start with a stolen or guessed credential, or with an employee talked into handing one over. Firms that test their own defenses against that reality, rather than assuming their perimeter security is enough, are the ones catching these gaps before an attacker does.</p>
<h2>Remedies for individuals: what to do if you&#8217;ve been affected</h2>
<p>For individuals who receive a breach notification like Apollo&#8217;s, or who suspect their data may be involved in this campaign, security practitioners generally recommend:</p>
<ul>
<li><strong>Enroll in the credit monitoring offered.</strong> Where a company the size of Apollo offers free monitoring through a service like Cyberscout, enrolling within the stated window costs nothing and provides an early warning system for fraudulent activity.</li>
<li><strong>Place a credit freeze with all three major credit bureaus</strong> (Equifax, Experian and TransUnion), not just the monitoring service offered by the breached company. A freeze blocks new lines of credit from being opened in your name until you lift it, and is free to place and remove.</li>
<li><strong>Watch for follow-on phishing.</strong> Breached personal data, including names, birth dates and addresses, is commonly used to make subsequent phishing or vishing attempts against the same individuals more convincing. Treat unexpected calls or emails referencing personal details with added scrutiny, particularly anything claiming to be from a bank, the IRS, or an employer&#8217;s IT department.</li>
<li><strong>File an identity theft report</strong> with the Federal Trade Commission at IdentityTheft.gov if you notice any signs of fraudulent activity, which creates a recovery plan and supporting documentation for disputing fraudulent accounts.</li>
</ul>
<h2>How to avoid becoming the next headline</h2>
<p>For financial services firms looking to avoid being the next name in a breach notification, the tactics used against Apollo and its peers point directly to the defenses that would have blunted them:</p>
<ul>
<li><strong>Move to phishing-resistant, FIDO2-based authentication</strong> rather than one-time passcodes or app-based push notifications, which can be defeated by adversary-in-the-middle (AiTM) phishing kits, tools that sit between a victim and a real login page to intercept credentials and session tokens as they&#8217;re entered in real time.</li>
<li><strong>Tighten IT helpdesk identity verification.</strong> Because these attacks rely on convincing an employee that the caller genuinely is internal IT, requiring a second, independent verification step, such as a callback to a known number or verification through a manager, before any password reset or MFA re-enrollment, closes the exact opening these attackers use.</li>
<li><strong>Shorten session lifetimes and enforce re-authentication</strong> for sensitive systems, so that a stolen session token has a smaller window in which to be useful to an attacker.</li>
<li><strong>Centralize authentication through single sign-on</strong> so that security controls, monitoring and anomaly detection apply consistently across every application employees use, rather than varying system by system.</li>
<li><strong>Run regular social engineering simulations</strong> against staff, including phone-based pretexting, not just email phishing tests, since this campaign&#8217;s primary technique is a phone call, not an email.</li>
</ul>
<h2>What happens next</h2>
<p>According to Google security researchers, who published detailed <a href="https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments" target="_blank" rel="nofollow noopener">threat intelligence on this campaign</a> earlier this month, the group behind it, tracked as UNC6671 and operating under the aliases Falcon, Helix, Pink and Redact, has been steadily shifting its focus toward higher-value targets. Google&#8217;s researchers describe the group&#8217;s targeting moving from manufacturing, real estate, healthcare and insurance in the spring, to technology and intellectual property-heavy targets by early summer, and then specifically to financial services, private equity and law firms by July, sectors the researchers note are attractive for their mergers and acquisitions activity, capital deployment decisions and sensitive litigation data.</p>
<p>The technique itself has stayed consistent throughout: calls to employees&#8217; personal mobile phones, impersonating IT helpdesk staff with an urgent pretext, most often a mandatory multi-factor authentication or passkey enrollment update, that directs the employee to a convincing but fake login page. Once credentials and authentication codes are entered there, the attackers use adversary-in-the-middle infrastructure to capture and reuse the live session, giving them access without ever needing to guess a password or exploit a software vulnerability.</p>
<p>Google&#8217;s researchers also noted that the group&#8217;s domain registration activity accelerated through June and July, with new lookalike domains appearing roughly once every 1.6 days by mid-summer, up from once every 2.2 days earlier in the year, a sign the campaign shows no indication of slowing down. For financial services firms managing sensitive client and deal data, the message from researchers is that the exposure isn&#8217;t hypothetical: it is an active, ongoing campaign that has already reached several of the largest names in the industry.</p>
<h2>Who can help</h2>
<p>Firms looking to test their own exposure to this style of attack before an incident, rather than after, typically start with the same categories of service Apollo and its peers are now being asked about publicly. <a href="https://www.digitalxraid.com/?source=NetworksJournal.com" target="_blank" rel="noopener nofollow">DigitalXRAID</a>, a UK-based cybersecurity company, offers a dedicated social engineering testing service that simulates phishing and pretexting attempts against a workforce and follows up with targeted training to close any gaps identified, alongside broader penetration testing, red teaming, and a 24/7 CREST-accredited security operations centre for firms that want ongoing monitoring and incident response instead of a one-off test.</p>
<p>For an industry built on protecting other people&#8217;s capital, the lesson from this summer&#8217;s campaign is a simple one: the weakest point in a financial services firm&#8217;s security is rarely its software. It&#8217;s the phone call an employee didn&#8217;t expect to have to question.</p>


Private Equity Firms Like Apollo Are Getting Hacked. Here’s What They’re Doing About It

<h2>Key Takeaways</h2>
<ul>
<li>Three very differently sized financial-services-adjacent companies, Bridgewater Associates (a giant hedge fund), Copp Clark (a small Canadian data vendor) and ICONOMI (a crypto investment platform), have taken three genuinely different approaches to cyber and operational risk, and the differences track company type and regulatory exposure closely, not one company simply doing more than the others.</li>
<li>Bridgewater&#8217;s Zero Trust rollout, rebuilding security around Microsoft 365 and identity-based access instead of a corporate firewall, is described in a case study that references COVID-19 as a live event and a Davos trip &#8220;this year,&#8221; dating it to roughly January to March 2020, before NIST had even published its formal Zero Trust Architecture framework. Genuinely early. Also, by 2026, Zero Trust has moved from differentiator to baseline expectation across financial services, with Gartner putting global, cross-industry adoption at around 63% and financial services among the leading adopter sectors.</li>
<li>Igor Tsyganskiy, quoted in that case study as Bridgewater&#8217;s CTO, later became Microsoft&#8217;s global Chief Information Security Officer in January 2024, succeeding a 14-year incumbent, then moved into an EVP role at Microsoft Research by March 2026, a genuinely notable trajectory worth knowing when reading his 2020 quote.</li>
<li>DORA and rising FCA scrutiny explain why a small vendor like Copp Clark and a crypto platform like ICONOMI are now investing in structured compliance work regardless of size: DORA became enforceable across the EU in January 2025, and the FCA reports over 40% of cyber incidents reported to it in 2025 involved a third party, exactly the exposure a company like Copp Clark represents to its financial-institution customers.</li>
<li>None of the three approaches is more &#8220;correct&#8221; than the others. A board&#8217;s actual task isn&#8217;t picking the best model off this list; it&#8217;s matching its own regulatory exposure and company size to the approach that fits, rather than assuming a giant asset manager&#8217;s playbook scales down, or a small vendor&#8217;s proportionate fix scales up.</li>
</ul>
<p>Put a hedge fund, a reference-data vendor and a crypto platform in the same room and they&#8217;ll describe completely different security priorities, and all three will be right. Bridgewater Associates, Copp Clark and ICONOMI sit at genuinely different points on the financial-services risk spectrum, by size, by regulatory exposure, by what an attacker or a regulator actually cares about in each case, and comparing what each one actually did is a more useful exercise for a UK C-suite than treating any single approach as the model to copy.</p>
<h2>Bridgewater: a genuinely early Zero Trust move, worth dating precisely</h2>
<p>Bridgewater Associates, at the time one of the world&#8217;s largest hedge funds managing roughly $150 billion, had built its security around a traditional perimeter that made remote and mobile access difficult and limited how far cloud collaboration could go. &#8220;We developed a vision to improve productivity and collaboration and deliver comprehensive mobile access, but to achieve this goal, we needed to overhaul our technology,&#8221; said Anthony Golia, Head of Productivity and Endpoint Engineering at Bridgewater Associates. Xantrion, working alongside Microsoft, rebuilt Bridgewater&#8217;s security model around Zero Trust principles using Microsoft 365, replacing reliance on the corporate firewall with granular, identity-based access controls. &#8220;Since implementing a Zero Trust strategy using Microsoft 365 technologies, our employees can fulfill their company duties from anywhere in the world while maintaining tight control over core security needs. This has been extremely valuable now that all of our company is working from home due to COVID-19. Everyone is working from an insecure environment today, and with our Zero Trust strategy in place, we are confident we can keep our data safe,&#8221; said Igor Tsyganskiy, Chief Technology Officer at Bridgewater Associates. &#8220;Because we collaborated with Microsoft to improve our security controls, I can access my files on OneDrive as if I was in the office. When we went to the World Economic Forum meetings at Davos this year, I accessed my files from my iPad just like I would in the office, so my team could continue to adjust the presentations throughout the conference. In the past, we wouldn&#8217;t have allowed this kind of access from a public location, making that collaboration more difficult,&#8221; said Greg Jensen, co-Chief Investment Officer at Bridgewater Associates.</p>
<p>Two details worth being precise about. First, the timing: a case study referencing COVID-19 as a live disruption and a Davos trip &#8220;this year&#8221; places this rollout roughly in the first quarter of 2020, Davos 2020 ran 21 to 24 January that year, meaning Bridgewater had rebuilt its access model around Zero Trust principles before NIST published its own formal Zero Trust Architecture framework, SP 800-207, in August 2020. That&#8217;s a genuinely early move by a large financial institution, not a follow-the-herd decision. Second, worth knowing when reading Tsyganskiy&#8217;s quote: he later left Bridgewater, joined Microsoft as chief strategy officer for security in September 2023, and was named Microsoft&#8217;s global Chief Information Security Officer effective January 2024, succeeding a CISO who&#8217;d held the role for 14 years, before moving into an EVP role at Microsoft Research by March 2026. The person describing this Zero Trust rollout went on to run security for one of the world&#8217;s largest technology companies, a detail that adds real weight to the quote without needing embellishment. On scale, it&#8217;s also worth noting Bridgewater&#8217;s assets under management have since fallen from roughly $150 billion to around $92 billion as of the end of September 2025, a deliberate downsizing toward investment agility rather than a distress signal, but the two figures describe different points in time and shouldn&#8217;t be conflated.</p>
<h2>Copp Clark and ICONOMI: proportionate compliance, not the Bridgewater playbook scaled down</h2>
<p>Copp Clark, a small Canadian company supplying financial institutions with global public holiday, trading hour and close-day data, took a completely different route: not a wholesale security architecture rebuild, but a scoped DORA gap assessment and Digital Operational Resilience Testing, deliberately calibrated to avoid &#8220;compliance activities that went beyond what its actual role required,&#8221; in the case study&#8217;s own words. That&#8217;s the right instinct for a company of its size and role, DORA became enforceable across the EU in January 2025, and the FCA has reported that more than 40% of cyber incidents reported to it in 2025 involved a third party, exactly the exposure a small data vendor represents to the financial institutions that rely on it. ICONOMI took a third route again: an onboarding and functional testing pass alongside its FCA cryptoasset AML registration, a compliance track specific to crypto platforms rather than to financial-services vendors generally. Neither company needed, or attempted, a Bridgewater-scale Zero Trust rebuild, and that&#8217;s the correct call, not a lesser one; a reference-data vendor and a crypto onboarding flow carry a genuinely different risk profile than a global asset manager&#8217;s entire remote workforce.</p>
<h2>What actually explains the difference</h2>
<p>The pattern across all three isn&#8217;t effort or sophistication, it&#8217;s exposure. Financial services was the second most-targeted industry globally in the first half of 2025, roughly 19% of observed attacks, and 65% of financial firms reported being hit by ransomware in the prior year, with average breach costs in the sector running around $6 million. Regulatory pressure has risen to match: DORA&#8217;s enforcement, the FCA&#8217;s own reporting on third-party-linked incidents, and industry estimates suggesting only around half of EU financial institutions were fully DORA-compliant even a year into enforcement, all point toward a landscape where every company touching financial data, regardless of size, now has a specific compliance obligation attached to its specific role. Zero Trust has followed a similar arc inside large institutions: Gartner&#8217;s most recent research puts global, cross-industry Zero Trust adoption at around 63%, with financial services among the leading adopter sectors, meaning what Bridgewater did as a genuine early move in 2020 is, by 2026, closer to a baseline expectation for an organisation its size than a differentiator.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>The temptation with a comparison like this is to rank the three companies by how impressive their security story sounds. That&#8217;s the wrong exercise. Bridgewater needed, and built, a comprehensive architectural rebuild because it is a global asset manager with a large, distributed workforce handling extraordinarily sensitive data, and it did so early enough that the engineer who led it went on to run security at Microsoft. Copp Clark needed, and got, a proportionate compliance assessment scoped to its actual role as a third-party data vendor, not more than that. ICONOMI needed a compliance track specific to being a regulated crypto platform. The right question for a board isn&#8217;t &#8220;which of these should we copy.&#8221; It&#8217;s &#8220;which of these three profiles, by size, by data sensitivity, by regulatory category, actually matches our own position,&#8221; and then building the proportionate version of that answer, rather than either underbuilding against real exposure or over-engineering a Zero Trust programme a company&#8217;s actual risk profile doesn&#8217;t yet justify.</p>


What UK Financial Services Firms Are Actually Doing About Cyber Risk: 3 Approaches Compared

<h2>Key Takeaways</h2>
<ul>
<li>Two real companies, Arcata Cloud and Copp Clark, cleared two different compliance bars, SOC 2 and DORA, under real commercial pressure, and both stories are genuinely instructive for a UK C-suite, provided the specific claims are read precisely rather than treated as interchangeable proof of &#8220;being secure.&#8221;</li>
<li>Arcata Cloud passed SOC 2 Type 1 on its first attempt in four weeks. That&#8217;s a real, well-executed result, but Type 1 tests whether controls are properly designed at a single point in time, not whether they hold up under sustained operation, which is what SOC 2 Type 2 actually tests over a three-to-twelve-month observation window. Sophisticated enterprise buyers generally treat Type 1 as a credible first step, not the final answer.</li>
<li>Copp Clark, a Canadian reference-data provider, is described in its own case study as having &#8220;found itself classified as an ICT third-party service provider&#8221; under the EU&#8217;s DORA regulation. That&#8217;s a real and common pattern, being pulled into a financial customer&#8217;s own compliance register, but it&#8217;s a materially different, lighter designation than being named a formally-designated &#8220;Critical ICT Third-Party Provider&#8221; by EU regulators, a status held by only 19 firms globally as of the first official list published in November 2025.</li>
<li>Rigour, roughly ranked for a UK C-suite: Cyber Essentials (self-assessed, five baseline controls) sits well below Cyber Essentials Plus (independently tested), which sits below SOC 2 Type 1 (independently audited design), which sits below SOC 2 Type 2 (independently audited operation over time), with DORA sitting apart from all of them as a binding EU regulation rather than a certification at all.</li>
<li>None of that undermines what either company achieved. It means a board should ask a more specific question than &#8220;are they certified&#8221;: which specific standard, which tier of that standard, and tested over what period.</li>
</ul>
<p>Compliance certifications and regulatory labels tend to get treated in boardrooms as a single signal: certified or not, compliant or not. That flattens genuinely useful distinctions a UK C-suite should actually understand, both when evaluating its own posture and when reading a vendor&#8217;s claims. Two real case studies, one an enterprise SOC 2 audit under a hard launch deadline, one a Canadian company&#8217;s brush with EU financial regulation, are a useful way into what those distinctions actually are.</p>
<h2>Arcata Cloud: a real first-attempt pass, of a specific, faster kind of audit</h2>
<p>Arcata Cloud was four weeks from a public launch with a non-negotiable deadline: an enterprise customer had made SOC 2 Type 1 compliance a contractual condition of signing, and the audit had to be booked and passed inside that window. The company&#8217;s security posture had grown organically as the product was built, which meant nobody had a clear picture of where the actual gaps were. Hashorn ran a two-phase engagement, starting with comprehensive threat modelling using STRIDE analysis, a real, established methodology developed at Microsoft in 1999 covering spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, alongside a full application and infrastructure-as-code audit, then moving into prioritised hardening work. That included migrating secrets into HashiCorp Vault, tightening 213 separate IAM policies, and wiring DevSecOps tooling, Semgrep, Checkov and Trivy, into the pipeline so the same issues couldn&#8217;t creep back in unnoticed. &#8220;We knew our security posture had grown organically. We didn&#8217;t know we had two critical issues we&#8217;d been shipping for nine months. Hashorn found them, helped us fix them, and got us through SOC 2 on the first try,&#8221; said Priya Iyer, CTO of Arcata Cloud. By the company&#8217;s own account, Arcata Cloud launched with zero critical CVEs outstanding, all high and critical findings resolved before the deadline, and passed its SOC 2 audit on the first attempt with zero observations.</p>
<p>That&#8217;s a genuinely strong result, and it&#8217;s worth being precise about what it actually certifies. SOC 2 Type 1 assesses whether an organisation&#8217;s controls are suitably designed at a single point in time; SOC 2 Type 2 assesses whether those same controls actually operated effectively over a sustained observation period, typically three to twelve months. A four-week timeline is plausible and unremarkable for Type 1 specifically, industry sources put typical Type 1 timelines at four to eight weeks, precisely because there&#8217;s no observation period to wait out; it&#8217;s a design review, not an endurance test. Enterprise procurement teams generally treat a Type 1 report as a credible first step, sufficient to unblock an early deal, but expect a Type 2 report before granting deeper production access or renewing at scale. None of that diminishes what Arcata Cloud did under real time pressure. It means &#8220;passed SOC 2 on the first try&#8221; is the correct, honest description of a real achievement, and &#8220;proven secure over time&#8221; is a claim Type 1 doesn&#8217;t make, and isn&#8217;t designed to.</p>
<h2>Copp Clark: a real DORA engagement, with a classification worth reading precisely</h2>
<p>Copp Clark, a Canadian company supplying financial institutions with global public holiday, trading hour and close-day data, found itself classified as an ICT third-party service provider under the EU&#8217;s DORA regulation because of the European financial businesses it serves. The tricky part wasn&#8217;t the regulation itself, it was scoping Copp Clark&#8217;s proportional responsibility accurately, so the company didn&#8217;t drain its resources on compliance activities that went beyond what its actual role required. Sigma Software ran stakeholder interviews to map Copp Clark&#8217;s existing security processes, then performed a gap assessment benchmarked directly against DORA&#8217;s requirements for ICT third-party providers, producing a Risk Management Policy, Third-party Management Policy, Business Continuity &#038; Disaster Recovery Plan, and Incident Response Plan, followed by Digital Operational Resilience Testing, scoping a penetration test specifically to Copp Clark&#8217;s distributed infrastructure rather than running a blanket, resource-heavy assessment across everything. &#8220;It was our pleasure working with the Sigma Software. They provided friendly, professional, and informative support at all times,&#8221; said Carol Champ, VP – Operations at Copp Clark Limited. The engagement helped Copp Clark establish a security process aligned with both DORA and ISO 27001, and the company went on to pass third-party regulatory checks requested by its European financial customers.</p>
<p>DORA, which became enforceable across the EU on 17 January 2025, applies to a broad set of EU-regulated financial entities and, separately, to the ICT third-party providers those entities rely on. It&#8217;s worth understanding that &#8220;ICT third-party provider&#8221; status under DORA actually comes in two meaningfully different tiers. The ordinary tier is a classification a financial-services customer effectively assigns to its own vendors as it builds its required DORA Register of Information, a broad, genuinely somewhat ambiguous category at the edges that a company like Copp Clark can be pulled into simply by serving EU financial customers, exactly the pattern this case study describes. The second, formal tier is &#8220;Critical ICT Third-Party Provider&#8221; status, a designation made directly by the EU&#8217;s supervisory authorities, and it is a considerably narrower club: only 19 firms, mostly major cloud and technology providers, were named on the first official list, published in November 2025. The case study&#8217;s framing of Copp Clark as having &#8220;found itself classified&#8221; as an ICT third-party provider is an accurate and defensible description of the ordinary, customer-driven tier. It is not the same claim as formal critical-provider designation by EU regulators, and a board reading a similar case study elsewhere should keep that distinction in mind rather than assume every &#8220;DORA classification&#8221; story describes the same regulatory weight.</p>
<h2>A rigour decoder for the boardroom</h2>
<p>Set alongside the UK&#8217;s Cyber Essentials scheme, these two case studies map out a useful, honest hierarchy for a C-suite to keep in mind rather than treating every certification or regulatory mention as equivalent proof of security maturity. Cyber Essentials, at its base tier, is a self-assessed questionnaire against five fixed technical controls, externally verified but not independently audited; Cyber Essentials Plus adds genuine independent technical testing on top of the same five controls. SOC 2 goes considerably further, covering not just technical controls but change management, monitoring and alerting, incident response and vendor risk management, evidenced through documented policy and independent audit testing, with Type 1 checking that those controls are properly designed and Type 2 checking that they actually held up in practice over months of real operation. DORA sits apart from all of it: not a certification a company can hold at all, but a binding EU regulation with legal force, covering operational resilience, mandatory incident reporting timelines, a formal register of third-party relationships and, for the largest and most integrated providers, threat-led penetration testing. ISO 27001, the international information security management standard Copp Clark aligned to alongside its DORA work, is a genuinely useful practical foundation for DORA compliance, most compliance advisories treat it as a substantial head start, but it does not by itself satisfy DORA&#8217;s more specific obligations around incident-reporting timelines and the Register of Information.</p>
<h2>What a UK C-suite should actually ask</h2>
<p>Both of these case studies describe real, well-executed work under real constraints, a four-week deadline in Arcata Cloud&#8217;s case, a proportionality problem in Copp Clark&#8217;s. Neither deserves to be read as more, or less, than what it actually is. The useful discipline for a board, whether assessing its own posture or a vendor&#8217;s claims, is to stop accepting &#8220;certified&#8221; or &#8220;compliant&#8221; as a single, flat answer and ask three sharper questions instead: which specific standard is being claimed, which tier or type within that standard, Type 1 or Type 2, base Cyber Essentials or Plus, ordinary third-party status or formal critical designation, and tested or observed over what period. Arcata Cloud and Copp Clark both have real, creditable stories to tell. The value of understanding the fine print isn&#8217;t doubting either of them. It&#8217;s knowing exactly what to ask the next vendor whose case study is less carefully worded.</p>
